Bug Description

OpenClaw v2026.4.21 added a security check for secrets.json file permissions (ACL) on startup. On Windows, this check fails and causes the gateway to crash.

Additionally, secrets.json files with UTF-8 BOM cannot be parsed.

Root Cause

Issue 1: ACL verification unavailable on Windows

The new ACL verification code (in resolve module, e.g. resolve-EGCQfR12.js:123) throws an error when it cannot read effective ACL permissions on Windows:

// Current behavior:
if (perms.source === 'unknown') {
  throw new Error('ACL verification unavailable...');
}

On Windows, ACL information is often not accessible via the Node.js API used, so perms.source returns 'unknown', and the gateway crashes immediately.

Issue 2: UTF-8 BOM in secrets.json

If secrets.json contains a UTF-8 BOM (bytes EF BB BF at the start), Node.js JSON.parse() fails with a syntax error.

Steps to Reproduce

1. On Windows 11, install OpenClaw v2026.4.21 via npm install -g openclaw
2. Ensure secrets.json exists (created by wizard or manually)
3. Run openclaw gateway start or openclaw status
4. Gateway crashes with ACL verification error

Expected Behavior

• On Windows, when ACL verification is unavailable, the gateway should log a warning and continue (graceful degradation), not crash.
• secrets.json parsing should strip UTF-8 BOM before calling JSON.parse().

Workaround

1. Patch the source code: In the resolve module (e.g. resolve-EGCQfR12.js), change the throw to a silent skip when perms.source === 'unknown'.
2. Remove BOM from secrets.json: Rewrite the file as UTF-8 without BOM.

Environment

• OS: Windows 11 26200 x64
• Node.js: v24.14.0
• OpenClaw: v2026.4.21
• Installation: global npm

Suggested Fix

1. Change ACL verification to warn+continue instead of throw when perms.source === 'unknown':

if (perms.source === 'unknown') {
  logger.warn('ACL verification unavailable on this platform, skipping');
  // do NOT throw
}

2. Strip BOM before parsing secrets.json:

content = content.replace(/^\uFEFF/, '');
JSON.parse(content);

Thanks!